Server Side Encryption for Boot Disk using CMK

More Info:

Microsoft Azure provides multiple distinct layers of encryption protection for virtual machine (VM) managed disks. VM managed disks are encrypted with Azure Storage encryption, also known as Server-Side Encryption (SSE), using platform-managed keys (PMK), to protect your data at rest and help you meet your organizational security and compliance commitments. By default, VM managed disk volumes (OS and data disk volumes) use platform-managed encryption keys.

Risk Level

High

Address

Security

Compliance Standards

• CIS AZURE
• Cloudanix Best Practice
• HIPAA
• ISO 27001
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of Server Side Encryption for Boot Disk using CMK in Azure, follow the below steps:

1. Login to the Azure portal (https://portal.azure.com/)
2. Navigate to the virtual machine which needs to be remediated.
3. Click on "Disks" under the "Settings" section of the virtual machine.
4. Select the boot disk that needs to be encrypted.
5. In the "Encryption Settings" section, click on "Disk encryption set".
6. Click on "Create new" to create a new disk encryption set.
7. Select the appropriate subscription, resource group and region.
8. Provide a name for the disk encryption set and select the key vault which contains the Customer Managed Key (CMK).
9. Click on "Create" to create the disk encryption set.
10. Once the disk encryption set is created, select the disk encryption set from the "Encryption Settings" section of the boot disk.
11. Click on "Save" to save the changes.

The boot disk of the virtual machine will now be encrypted using the Customer Managed Key (CMK) stored in the selected key vault.

Using CLI

To remediate the misconfiguration of Server Side Encryption for Boot Disk using CMK in Azure, you can follow the below steps using Azure CLI:

1. Open Azure CLI and login to your Azure account using the command:

   az login

2. Once you are logged in, run the following command to identify the VM's boot disk that needs to be encrypted:

   az vm show -g <resource-group-name> -n <vm-name> --query storageProfile.osDisk.managedDisk.id -o tsv

3. Once you have identified the boot disk, run the following command to enable encryption on the boot disk using a customer-managed key:

   az disk encryption set --resource-group <resource-group-name> --name <disk-name> --key-url <key-url> --encryption-type <EncryptionType>

   Replace the following parameters in the command:

   • <resource-group-name>: Name of the resource group where the VM is located.
   • <disk-name>: Name of the disk that needs to be encrypted.
   • <key-url>: URL of the customer-managed key that needs to be used for encryption.
   • <EncryptionType>: Type of encryption to be used. In this case, it would be "EncryptionAtRestWithCustomerKey".

4. Once the encryption is enabled, you can verify the status of the encryption using the following command:

   az disk encryption show --resource-group <resource-group-name> --name <disk-name> --query encryptionSettingsCollection -o json

   This command will return the encryption settings for the disk in JSON format.

By following the above steps, you can remediate the misconfiguration of Server Side Encryption for Boot Disk using CMK in Azure using Azure CLI.

Using Python

To remediate Server Side Encryption for Boot Disk using CMK misconfiguration in Azure using Python, you can follow the below steps:

1. Import the necessary libraries:

from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.compute.models import DiskEncryptionSetParameters, EncryptionSettings, DiskEncryptionSettings, KeyVaultSecretReference
from azure.identity import DefaultAzureCredential

2. Set the credentials for authentication:

credential = DefaultAzureCredential()
subscription_id = 'your-subscription-id'
resource_group = 'your-resource-group'

3. Create an instance of the ComputeManagementClient:

compute_client = ComputeManagementClient(credential, subscription_id)

4. Get the virtual machine details:

vm_name = 'your-vm-name'
vm = compute_client.virtual_machines.get(resource_group, vm_name)

5. Get the OS disk details:

os_disk_name = vm.storage_profile.os_disk.name
os_disk = compute_client.disks.get(resource_group, os_disk_name)

6. Create a DiskEncryptionSetParameters object:

disk_encryption_set_parameters = DiskEncryptionSetParameters(
    identity=None,
    encryption_type='EncryptionAtRestWithCustomerKey',
    disk_encryption_key=None,
    key_encryption_key=None
)

7. Create an EncryptionSettings object:

encryption_settings = EncryptionSettings(
    enabled=True,
    disk_encryption_set_id='your-disk-encryption-set-id'
)

8. Create a DiskEncryptionSettings object:

disk_encryption_settings = DiskEncryptionSettings(
    disk_encryption_key=None,
    key_encryption_key=None,
    enabled=True,
    encryption_settings=encryption_settings
)

9. Create a KeyVaultSecretReference object:

key_vault_secret_reference = KeyVaultSecretReference(
    source_vault=None,
    secret_url='your-cmk-secret-url'
)

10. Update the OS disk with the new encryption settings:

os_disk.encryption_settings = disk_encryption_settings
os_disk.encryption_settings.disk_encryption_settings.disk_encryption_key.secret_url = key_vault_secret_reference.secret_url
os_disk.encryption_settings.disk_encryption_settings.disk_encryption_key.source_vault = key_vault_secret_reference.source_vault
compute_client.disks.create_or_update(resource_group, os_disk_name, os_disk)

Note: Make sure to replace the placeholders (your-subscription-id, your-resource-group, your-vm-name, your-disk-encryption-set-id, your-cmk-secret-url) with the actual values.

These steps will remediate the Server Side Encryption for Boot Disk using CMK misconfiguration in Azure using Python.

Using Terraform

# Customer-managed key in Key Vault
resource "azurerm_key_vault_key" "VM_BOOT_DISK_CMK" {
  name         = "VM-BOOT-DISK-CMK"
  key_vault_id = azurerm_key_vault.VM_KEY_VAULT_ID   # replace with your Key Vault resource or ID
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "encrypt",
    "decrypt",
  ]
}

# Disk Encryption Set that uses the CMK
resource "azurerm_disk_encryption_set" "VM_BOOT_DISK_DES" {
  name                = "vm-boot-disk-des"
  location            = azurerm_resource_group.RG.location         # replace with your RG resource
  resource_group_name = azurerm_resource_group.RG.name             # replace with your RG resource

  identity {
    type = "SystemAssigned"
  }

  key_vault_key_id = azurerm_key_vault_key.VM_BOOT_DISK_CMK.id
}

# Grant the DES access to the Key Vault key (example using access policy)
resource "azurerm_key_vault_access_policy" "VM_BOOT_DISK_DES_POLICY" {
  key_vault_id = azurerm_key_vault.VM_KEY_VAULT_ID.id              # replace with your Key Vault resource
  tenant_id    = azurerm_disk_encryption_set.VM_BOOT_DISK_DES.identity[0].tenant_id
  object_id    = azurerm_disk_encryption_set.VM_BOOT_DISK_DES.identity[0].principal_id

  key_permissions = [
    "get",
    "wrapKey",
    "unwrapKey",
  ]
}

# Azure Compute VM using CMK for the boot (OS) disk encryption
resource "azurerm_windows_virtual_machine" "VM_WITH_CMK_BOOT_DISK" {
  name                = "vm-with-cmk-boot-disk"
  location            = azurerm_resource_group.RG.location         # replace with your RG resource
  resource_group_name = azurerm_resource_group.RG.name             # replace with your RG resource
  size                = "Standard_DS1_v2"
  admin_username      = "ADMIN_USERNAME"                           # replace with admin username
  admin_password      = "ADMIN_PASSWORD"                           # replace with admin password
  network_interface_ids = [
    azurerm_network_interface.VM_NIC_ID,                           # replace with your NIC resource or ID
  ]

  os_disk {
    name                 = "vm-with-cmk-osdisk"
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"

    # This is the key setting that enables SSE with CMK for the boot disk
    disk_encryption_set_id = azurerm_disk_encryption_set.VM_BOOT_DISK_DES.id
  }

  source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = "2022-datacenter-azure-edition"
    version   = "latest"
  }
}

Substitute:

• azurerm_resource_group.RG with your resource group.
• azurerm_key_vault.VM_KEY_VAULT_ID with your Key Vault resource.
• azurerm_network_interface.VM_NIC_ID with your NIC resource or ID.
• ADMIN_USERNAME / ADMIN_PASSWORD with your secure values (ideally from variables).

Changing disk_encryption_set_id on an existing OS disk forces replacement of the OS disk and typically the VM (expect downtime and recreation).

To verify, terraform plan should show:

• creation of azurerm_disk_encryption_set.VM_BOOT_DISK_DES;
• a Key Vault access policy for its identity;
• the VM’s os_disk gaining disk_encryption_set_id (or the VM being replaced with the new encrypted OS disk).